GHSA-wv64-j4fq-5f9x: Medium severity maven/org.http4s:http4s-client_3 vulnerability
When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.
Impact
Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.
Preconditions
- Application uses the CookieJar client middleware. - Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.
Workarounds
- Do not share a CookieJar across trusted and untrusted targets.
Note
This middleware still does not implement public suffix rejection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.http4s:http4s-client_3to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-client_3to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-client_2.13to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-client_2.13to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-client_2.12to a version that resolves this vulnerability.Fixed in 0.23.35 - Configuration
Do not share a single CookieJar instance (client middleware) between trusted and untrusted targets; use separate CookieJar instances per trust boundary to prevent a malicious/compromised server from planting cookies that get sent to victim domains later.
CookieJar client middleware CookieJar reuse across targets (trusted vs untrusted) = Do not share across trusted and untrusted targets
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they use the CookieJar client middleware and use the same cookie jar when contacting both trusted hosts and an attacker-controlled or compromised server.
What must an attacker be able to do to exploit it?
An attacker needs to control, or compromise, a server that the application contacts using the shared CookieJar. That server can return a Set-Cookie response with a Domain attribute for another domain that the client later contacts.
What is the practical impact of a successful attack?
The malicious server can cause the client to send an attacker-planted cookie on a later request to an arbitrary victim domain in the same jar. This can enable session fixation or overwrite cookies that are relevant to security.
What can be done if updating is not immediately possible?
Do not share a CookieJar between trusted and untrusted targets. Use separate cookie jars so cookies received from untrusted or potentially compromised servers cannot be reused for trusted hosts.
Does the middleware reject cookies for public suffixes?
No. The middleware still does not implement public suffix rejection.